HIPAA: Privacy Regulations Addressing HIPAA at Harvard University Tina S. Sheldon Harvard University

1. HIPAA: Privacy RegulationsAddressing HIPAA at Harvard UniversityTina S. SheldonHarvard University HIPAA Summit West II San Francisco, California March 13-15, 2002

2. Agenda • Inside Harvard Yard • HIPAA’s Impact on Harvard • Harvard’s Approach to HIPAA • HIPAA Issues & Operational Concerns

3. Inside Harvard Yard • Understanding Harvard • Designating a HIPAA Team • Communicating with the Governing Body • Building University-wide Partnerships

4. HIPAA Risk Assessment • Inventoried Protected Health Information on Campus • Identified Covered Entities on Campus • Reviewed Non-Covered Entities’ Use of Protected Health Information • Examined Statutory Exceptions

5. University Health Services Dental School Dental Clinics Mental Health Services (Schools) Student Athletics Faculty & Staff Assistance Program University Group Health Plan Flexible Spending Account Workers’ Compensation Disability Plan Research with Human Subjects Protected Health Information On Campus

6. Covered Entities on Campus • Health Care Providers • University Health Services • Dental School Dental Clinics • Health Plan • University Group Health Plan • Health Care Clearinghouse • None

7. Mental Health Services Student Services: Records Protected by FERPA Student Athletics Student Services: Records Protected by FERPA Faculty & Staff Assistance Referral Service, No Records Flexible Medical Spending Account Grievance Board: ERISA Workers’ Compensation & Disability Programs Self-Insured, Self-Managed Programs: State Preemption Researchwith Human Subjects IRB Approval Process Non-Covered Entities & HIPAA Analysis

8. Bifurcated Approach: Health Care • Constituents • University Health Services • Dental School Dental Clinics • University Group Health Plan • Human Resources: Benefits Group • Sponsored Training • HIPAA Tutorial: McDermott, Will & Emery • Convened HIPAA Work Group • Members: Multi-Disciplinary (Clinical & Administrative) • Assess Practices & Inventory Vendor Relations • Develop HIPAA Work Plan • Create Forms & Policies • Conduct Staff Training

9. Bifurcated Approach: Research • Constituents • Institutional Review Boards • Office of Sponsored Research • Principal Investigators • Sponsored Training • HIPAA Workshop: McDermott, Will & Emery • Case Study Discussion • Created HIPAA Research Brochure • Charged IRB Operations Group • IRB Administrators • Office of Sponsored Research • Office of General Counsel • Risk Management & Audit Services

10. HIPAA Issues & Operational Concerns • Hybrid Organization • Primary Function: Education & Research • Designate Health Care Components • Document Designation: Corporate Vote • Privacy Officer • Each Covered Entity will Designate Privacy Officer • Each Privacy Officer will have Access to Governing Body • Student Services • FERPA vs. HIPAA • Transfer Issue: EMTALA • Consent Issue: Freshman Physicals

11. HIPAA Issues & Operational Concerns • Dental School Dental Clinics • Faculty Practice & Teaching Practice • Dental School Students: HIPAA Training? Medical Records? • Volunteer Teaching Faculty: How HIPAA Wise? • Research with Human Subjects: • 3 IRBs: Different Types of Studies & Data Points • Longitudinal Studies: Study Drop-outs & Aggregated Database? • PI Status: Covered Entity? • PI Request: Further Analysis of Data? • Colleague Request: Comparative Use of Data? • Cooperative Agreements: Whose IRB Reviews?

12. Closing Comments • Numerous Challenges Ahead • Many Unanswered Questions • Look to Associations & Industry Groups • Document HIPAA Expenses